From 37c32360e961f16a3d98bf4a0194f48cdcbe43f9 Mon Sep 17 00:00:00 2001 From: KJGBot Date: Thu, 8 Oct 2026 16:04:53 -0700 Subject: [PATCH] ci: harden trunk gating - CI gates also require the head repo to be this repository and the base to be main (a fork branch named trunk, or trunk into another branch, no longer runs CI). - Trunk guard runs via pull_request_target (loaded from the base branch, so a PR cannot edit it to pass), re-runs on base edits, and checks head repo. - Workflows that only react to a PR closing are no longer gated. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/container-integration.yml | 2 +- .github/workflows/preview.yml | 2 +- .github/workflows/trunk-guard.yml | 15 ++++++++++----- 4 files changed, 15 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c13edc21..aabecbb7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ permissions: jobs: ci: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Lint, Build & Test runs-on: ubuntu-latest steps: @@ -33,7 +33,7 @@ jobs: - run: npm run test:container container: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Container (${{ matrix.platform }}) runs-on: ubuntu-latest timeout-minutes: 25 @@ -134,7 +134,7 @@ jobs: run: docker rm --force --volumes relaycast-ci-${{ matrix.arch }} 2>/dev/null || true rust-sdk: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Rust SDK runs-on: ubuntu-latest steps: diff --git a/.github/workflows/container-integration.yml b/.github/workflows/container-integration.yml index 1303e4d8..21d46e28 100644 --- a/.github/workflows/container-integration.yml +++ b/.github/workflows/container-integration.yml @@ -47,7 +47,7 @@ permissions: jobs: container-integration: - if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk' + if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main') name: Build and test the real image runs-on: ubuntu-latest timeout-minutes: 15 diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index 63d2a521..f0568d21 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -17,7 +17,7 @@ jobs: cleanup-preview: name: Cleanup Preview if: >- - ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') && + ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || (github.head_ref == 'trunk' && github.event.pull_request.head.repo.full_name == github.repository && github.base_ref == 'main')) && (github.event.action == 'closed' && (github.event.pull_request.merged == true || github.event.pull_request.state == 'closed') && github.event.pull_request.head.repo.full_name == github.repository) runs-on: ubuntu-latest env: diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml index 2ddb4975..fbe379e4 100644 --- a/.github/workflows/trunk-guard.yml +++ b/.github/workflows/trunk-guard.yml @@ -1,17 +1,22 @@ name: Trunk guard -# Only the `trunk` branch may merge into main. Feature branches merge into -# `trunk` (via the merge train); CI runs only on the trunk -> main PR. +# Only this repository's `trunk` branch may merge into main. Feature branches +# merge into `trunk`; CI runs only on the trunk -> main PR. +# pull_request_target loads this workflow from the base branch, so a PR cannot +# edit the guard to pass itself. It never checks out PR code. on: - pull_request: + pull_request_target: branches: [main] + types: [opened, synchronize, reopened, edited] + +permissions: {} jobs: only-trunk-merges-to-main: - if: github.head_ref != 'trunk' + if: github.head_ref != 'trunk' || github.event.pull_request.head.repo.full_name != github.repository runs-on: ubuntu-latest timeout-minutes: 1 steps: - run: | - echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'." + echo "::error::Only this repository's 'trunk' branch may merge into main. Retarget this PR to 'trunk'." exit 1